api.php

<?php

require_once("common.php");

@ini_set( 'upload_max_size' , '1M' );
@ini_set( 'post_max_size', '1M');

define("AUTH_SHARED_SECRET", 2);
define("AUTH_USER_OAUTH", 3);


if (!isset($_GET['q']) || $_GET['q'] == '') {
    tellError("missing params", 400);
}
$qRaw = $_GET['q'];
$q = explode('/', $qRaw);

if (count($q) < 2) {
    tellError("missing params", 400);
}
//$version = $q[0];
//$authRaw = $q[count($q) - 1];


// API VERSION 1
if (count($q) > 0 && $q[0] == "v1") {

    if (count($q) > 1 && $q[1] == 'auth') {

        if (count($q) > 2 && $q[2] == 'nonce') {
            tellError("unimplemented method", 400);

        } else {
            tellBadMethod();
        }


    } else if (count($q) > 1 && $q[1] == 'channel') {

        if (count($q) > 2 && $q[2] == 'list') {
            apiChannelList($q);

        } else if (count($q) > 2 && ($q[2] == 'join' || $q[2] == 'part')) {
            apiChannelUpdate($q);

        } else if (count($q) > 2 && $q[2] == 'update') {

            if (count($q) > 3 && $q[3] == 'config') {
                apiChannelUpdateConfig($q);

            } else if (count($q) > 3 && $q[3] == 'boir') {
                apiChannelUpdateBoir($q);

            } else {
                tellBadMethod();

            }

        } else {
            tellBadMethod();

        }


    } else if (count($q) > 1 && $q[1] == 'vars') {

        if (count($q) > 3) {
            apiVars($q);
        } else {
            tellBadMethod();

        }


    } else if (count($q) > 1 && $q[1] == 'reqsongs') {

        if (count($q) > 3 && $q[2] == 'list') {
            apiReqsongsList($q);

        } else if (count($q) > 3 && $q[2] == 'add') {
            apiReqsongsAdd($q);

        } else {
            tellBadMethod();

        }


    } else {
        tellBadMethod();

    }


} else {
    tellError("bad api version", 400);
}




/***************
 * API METHODS
 **************/

function apiReqsongsAdd($query) {

    authOrDie($query, AUTH_SHARED_SECRET);

    $channel = channelOrDie($query);
    requirePostParams(array("url", "requestedBy"));

    $url = $_POST['url'];
    $requestedBy = $_POST['requestedBy'];

    // weakish url checking
    $parsedUrl = parse_url($url);

    if (!$parsedUrl
        || !array_key_exists("scheme", $parsedUrl)
        || !array_key_exists("host", $parsedUrl)
        || !array_key_exists("path", $parsedUrl)) {
        tellBadParam("url");
    }
    $parsedUrl["host"] = strtolower($parsedUrl["host"]);

    if (stripos(strrev($parsedUrl["host"]), "moc.ebutuoy") !== 0
        && stripos(strrev($parsedUrl["host"]), "eb.utuoy") !== 0) {
        tellBadParam("url");
    }

    // validate the requestedBy twitch name
    if (!validateChannel($requestedBy)) {
        tellBadParam("requestedBy");
    }

    $reqsong = dbCreateReqsong($channel, $url, $requestedBy);

    if (!$reqsong) {
        tellError("database error", 500);
    }

    //$response = array('reqsongs' => $reqsongs);

    tellSuccess();
}

function apiReqsongsList($query) {

    $channel = channelOrDie($query);

    $reqsongs = dbListReqsongs($channel);

    if ($reqsongs === NULL) {
        tellError("database error", 500);
    }

    $response = array('reqsongs' => $reqsongs);

    tellSuccess($response);
}

function apiVars($query) {

    $channel = channelOrDie($query);
    $varName = $query[3];
    if (!preg_match('/^[A-Z0-9\-]{1,64}$/i', $varName)) {
        tellError("bad varname", 400);
    }


    if ($query[2] == 'set') {

        authOrDie($query, AUTH_SHARED_SECRET);

        $json = json_decode(file_get_contents("php://input"));
        if ($json == false || !property_exists($json, "value")) {
            tellBadParam('json');
        }

        $value = $json->value;
        if (strlen($value) > 255) {
            tellBadParam('value');
        }

        // if (property_exists($json, "description")) {
        //     $description = $json->description;
        //     if (strlen($description) > 255) {
        //         tellBadParam('description');
        //     }
        //     $success = dbSetVar($channel, $varName, $value, $description);

        // } else {
            $success = dbSetVar($channel, $varName, $value);
        // }

        if ($success) {
            tellSuccess();
        } else {
            tellError("database error", 500);
        }


    } else if ($query[2] == 'increment') {

        authOrDie($query, AUTH_SHARED_SECRET);

        $json = json_decode(file_get_contents("php://input"));
        if ($json == false || !property_exists($json, "incAmount")) {
            tellBadParam('json');
        }

        $incAmount = $json->incAmount;
        if (!is_int($incAmount) && !is_float($incAmount)) {
            tellBadParam('incAmount');
        }

        $result = dbIncrementVar($channel, $varName, $incAmount);

        if ($result !== false) {
            $response = array("newValue" => $result);
            tellSuccess($response);
        } else {
            tellError("database error", 500);
        }


    } else if ($query[2] == 'unset') {

        authOrDie($query, AUTH_SHARED_SECRET);

        $success = dbDeleteVar($channel, $varName);

        if ($success === false) {
            tellError("database error", 500);
        } else if ($success === NULL) {
            tellError("var not found", 404);
        }

        tellSuccess();


    } else if ($query[2] == 'get') {

        $row = dbGetVar($channel, $varName);

        if ($row === false) {
            tellError("database error", 500);
        } else if ($row === NULL) {
            tellError("var not found", 404);
        }

        tellSuccess($row);


    } else {
        tellBadMethod();

    }
}

function apiChannelList($query) {

    $channels = dbListChannels();

    if ($channels === NULL) {
        tellError("database error", 500);
    }

    $response = array('channels' => $channels);

    tellSuccess($response);
}


function apiChannelUpdate($query) {

    authOrDie($query, AUTH_SHARED_SECRET);
    $channel = channelOrDie($query);
    // requirePostParams(array("displayName"));

    // $displayName = $_POST["displayName"];
    $isActive = NULL;

    if ($query[2] == "join") {
        $isActive = true;
    } else if ($query[2] == "part") {
        $isActive = false;
    } else {
        tellError("unknown error", 500);
    }

    $twitchObj = twitchGetChannel($channel);

    if ($twitchObj === false || $twitchObj === NULL || !(property_exists($twitchObj, "display_name"))) {
        tellError("twitch api unavailable", 503);

    } else if (property_exists($twitchObj, "error")) {
        tellError("twitch api error: " . $twitchObj->status . " " . $twitchObj->error, 400);
    }

    $displayName = $twitchObj->display_name;

    $authArray = getAuthArray($query);
    $botChannel = $authArray[2];

    $success = dbSetChannel($channel, $displayName, $isActive, $authArray[2]); // TODO eventually need to pass identifier of bot

    if ($success) {
        tellSuccess();
    } else {
        tellError("database error", 500);
    }
}


function apiChannelUpdateConfig($query) {

    authOrDie($query, AUTH_SHARED_SECRET);
    $channel = channelOrDie($query);

    $json = json_decode(file_get_contents("php://input"));
    if ($json === false) {
        tellBadParam('json');
    }

    file_put_contents('configs/' . $channel . '.json', json_encode($json), LOCK_EX);

    tellSuccess();
}


function apiChannelUpdateBoir($query) {

    authOrDie($query, AUTH_USER_OAUTH);
    $channel = channelOrDie($query);

    $json = json_decode(file_get_contents("php://input"));
    if ($json === false) {
        tellBadParam('json');
    }

    file_put_contents('configs/boir/' . $channel . '.json', json_encode($json), LOCK_EX);

    dbSetChannelShowBoir($channel, true);

    tellSuccess();
}




/******************
 * AUTHENTICATION
 *****************/

function authOrDie($query, $authMethod) {

    if (!checkAuthFromRaw($query, $authMethod)) {
        tellError("bad auth", 403);
    }
}

function checkAuthFromRaw($query, $authMethod) {
    $checkChannel = NULL;
    // channel is required for oauth check, so force $checkChannel
    if ($authMethod == AUTH_USER_OAUTH) {
        $checkChannel = true;
    }
    if ($authMethod == AUTH_SHARED_SECRET) {
        $checkChannel = true; // for now
    }


    $authArr = getAuthArray($query);
    if (count($authArr) != 3) return false;

    $a = $authArr[1];
    $botChannel = strtolower($authArr[2]);

    $chan = false;

    if ($checkChannel) {
        $chan = channelOrDie($query);
    }

    if ($authMethod == AUTH_SHARED_SECRET) {
        return checkAuthApiKey($a, $botChannel, $chan);

    } else if ($authMethod == AUTH_USER_OAUTH) {
        return checkOauthToken($a, $chan);

    } else {
        return false;
    }
}

function checkAuthApiKey($auth, $botChannel, $channel) {
    //global $TEMP_AUTH_KEY;
    if (isset($botChannel) && $botChannel != "*") {
      if (!dbCheckBotAuth($botChannel, $auth)) return false;
    } else {
      if (!dbCheckApiuserAuth($auth, $channel)) return false;
    }

    if ($channel === false) return false;

    $channelData = dbGetChannel($channel);
    if ($channelData === false) return false;

    return $channelData === NULL || !$channelData['isActive'] || ($botChannel == "*" || $botChannel == $channelData['botChannel']);
}

function checkOauthToken($auth, $channel) {
    if (!validateOauthToken($auth)) {
        return false;
    }

    $curlSession = curl_init();
    curl_setopt($curlSession, CURLOPT_URL, 'https://api.twitch.tv/kraken/user?oauth_token=' . $auth);
    curl_setopt($curlSession, CURLOPT_BINARYTRANSFER, true);
    curl_setopt($curlSession, CURLOPT_RETURNTRANSFER, true);

    $jsonData = json_decode(curl_exec($curlSession));
    curl_close($curlSession);

    return property_exists($jsonData, "name") && $channel == ($jsonData->name);
}

function validateOauthToken($token) {
    return preg_match('/^[A-Z0-9]*$/i', $token);
}




/********************
 * PARAMETER CHECKS
 *******************/

// returns the channel from a query, or terminates the script if it's unobtainable
function channelOrDie($query) {
    $chan = getChannelFromQuery($query);
    if ($chan === false) {
        tellError("missing channel", 400);
    }
    return $chan;
}

// pulls a channel from a query array
function getChannelFromQuery($query) {
    //if (count($query) < 3) return false;
    $authArr = getAuthArray($query);
    $chan = $authArr[0];

    // this check is crucial!!! huge server vulnerability if this check is removed
    if (!validateChannel($chan)) return false;

    return $chan;
}

function getAuthArray($query) {
    return explode('$', $query[count($query) - 1]);
}

// die if any of a list of POST params are missing
function requirePostParams($params) {
    for ($i = 0; $i < count($params); $i++) {
        $param = $params[$i];
        if (!isset($_POST[$param]) || $_POST[$param] == '') {
            tellBadParam($param);
        }
    }
}




/**********************
 * RESPONSE TO CLIENT
 *********************/

function tellSuccess($response=array()) {
    tellError("ok", 200, $response);
}

function tellBadMethod($response=array()) {
    tellError("bad method", 400, $response);
}

function tellBadParam($param) {
    tellError("bad param: " . $param, 400);
}

function tellError($msg, $code=400, $response=array()) {
    http_response_code($code);
    $response["status"] = $msg;
    respond($response);
}

function respond($response) {
    header('Content-type: application/json');
    die(json_encode($response));
}




/*function getNonce() {
    $id = Identify Request //(either by username, session, or something)
    $nonce = hash('sha512', makeRandomString());
    storeNonce($id, $nonce);
    return $nonce to client;
}

verifyNonce($data, $cnonce, $hash) {
    $id = Identify Request
    $nonce = getNonce($id);  // Fetch the nonce from the last request
    removeNonce($id, $nonce); //Remove the nonce from being used again!
    $testHash = hash('sha512',$nonce . $cnonce . $data);
    return $testHash == $hash;
}

function makeRandomString($bits = 256) {
    $bytes = ceil($bits / 8);
    $return = '';
    for ($i = 0; $i < $bytes; $i++) {
        $return .= chr(mt_rand(0, 255));
    }
    return $return;
}*/

?>